PT-2026-39679 · Amir20+2 · Dozzle+1

Q1Uf3Ng · Published 2026-05-11 · Updated 2026-05-28 · CVE-2026-44985

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dozzle versions prior to 10.5.2

Description The WebSocket upgrader for the '/exec' and '/attach' endpoints accepts upgrade requests from any origin because it uses a custom CheckOrigin function that always returns true. When combined with the JWT cookie using SameSite: Lax, this allows Cross-Site WebSocket Hijacking (CSWSH). An attacker hosting a page on a same-site origin (such as a sibling subdomain or another service on localhost) can initiate a WebSocket connection to the exec endpoint. This connection carries the victim's valid JWT cookie, allowing the attacker to gain interactive shell access to any container the victim is authorized to access.

Recommendations Update to version 10.5.2. As a temporary workaround, restrict access to the '/exec' and '/attach' endpoints to minimize the risk of exploitation.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2026-44985

GHSA-J643-X8PV-8M67

Affected Products

Dozzle

Github.Com/Amir20/Dozzle

References · 8

• 🔥 https://github.com/amir20/dozzle/security/advisories/GHSA-j643-x8pv-8m67 · Exploit
• https://osv.dev/vulnerability/GHSA-j643-x8pv-8m67 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44985 · Security Note
• https://github.com/amir20/dozzle/releases/tag/v10.5.2 · Note
• https://github.com/amir20/dozzle · Note
• https://t.me/CVEtracker/55036 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2059542036982755339 · Twitter Post
• https://t.me/cveNotify/165076 · Telegram Post